At this point we've all heard about AI agents as well as subagents. More recently, however, are skills. Skills are configurations that you can use to tell the agent how to act as well as how not to act. So if you're a developer and already have a specific architecture that you use, instead of always having to remind the agent that it needs to abide by that architecture, you can say it once in the skill and the agent will always refer to it. You can create a skill for UX design, full stack development, or Italian cooking. As the popularity of skills increased, so did the amount of people who wanted to buy these skills instead of creating their own. And so skill marketplaces were born.
This week we were able to see how one firm, AIR, was able to upload a fake skill to one of these marketplaces. That is, a skill that didn't do what it said but instead downloaded and ran a script that quietly returned to the firm the email address of every person who used it. By their count it reached around 26,000 agents, some of them sitting on corporate accounts.
How they pulled it off
AIR didn't hack anything or find a zero-day. They faked the handful of signals people use to trust a skill: the star count, a clean scanner result, and the credibility of being open source.
The skill was called brand-landingpage and promised to build a landing page with Google's Stitch design tool. It wasn't aimed at security engineers — it targeted marketers, salespeople, and designers, the people least likely to open the SKILL.md and read what it does. For the stars, AIR opened a pull request to a skill marketplace repo sitting at around 36,000 stars. A few days later it got merged, and the skill inherited the repo's reputation without earning any of it. An Instagram ad brought in the installs.
The bait and switch
The skill itself was clean. Scan the package — the SKILL.md and the files shipped with it — and there's nothing to find, which is exactly what Cisco's scanner, NVIDIA's, and the ones built into skills.sh all do.
But the skill didn't carry its own setup instructions. It told the agent to install the "Stitch SDK" from an external link, stitch-design.ai — a domain AIR owns, not Google (the real Stitch lives at stitch.withgoogle.com). At first that link pointed to the genuine Stitch docs, so the scanners cleared it. The page the agent would actually fetch was never part of the scan.
Once the skill was installed widely, AIR swapped the page. The new version told the agent to download and run a script. In the demo it only mailed back the user's email, but the same foothold could read files, move data, or reach internal systems — bounded only by what the agent could touch.
Why scanners can't catch this
The scanner isn't broken. It checked the package at one moment, and at that moment it was fine. The problem is structural: the scan happens once, but the page a skill points to can be rewritten any time after. It's a snapshot of something allowed to change the second you look away.
AIR isn't the first to show this. Three weeks earlier, Trail of Bits got past ClawHub's detector, Cisco's scanner, and all three scanners on skills.sh, with the same conclusion: a scanner checks a fixed package, an attacker just keeps tweaking until it passes. Anthropic's own docs already warn that skills fetching external URLs are risky for exactly this reason.